求助：老旧设备Modbus通信数据的CRC计算问题

处理老旧设备通信数据的CRC计算时遇到瓶颈：数据看似符合Modbus格式，但尝试了各种算法、poly、xorin、xorout等参数均无法匹配正确结果。目前能解析数据内容，但完全摸不清对应的CRC计算规则，试过CRC计算工具和逆向工具都无进展，求可行的排查思路。

捕获的通信数据包 #

02 2e 05 0f 01 04 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 8e 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6f 01 00 00 00 00 68 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 8f 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6f 01 00 00 00 00 6e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 91 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6f 01 00 00 00 00 7e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 92 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6e 01 00 00 00 00 66 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 92 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6e 01 00 00 00 00 66 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 93 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6e 01 00 00 00 00 6e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 95 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6e 01 00 00 00 00 7e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 95 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6e 01 00 00 00 00 7e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 96 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6e 01 00 00 00 00 86 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 97 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6d 01 00 00 00 00 6e 
02 2e 05 0f 01 04 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 98 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6d 01 00 00 00 00 78 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 99 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6d 01 00 00 00 00 7e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 9a 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6d 01 00 00 00 00 86 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 9a 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6d 01 00 00 00 00 86 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 9b 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6d 01 00 00 00 00 8e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 9d 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6c 01 00 00 00 00 7e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 9d 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6c 01 00 00 00 00 7e 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 9e 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6c 01 00 00 00 00 86 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 a0 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6c 01 00 00 00 00 96 
02 2e 05 0f 01 00 00 01 00 00 00 00 00 00 00 c3 1d 00 00 01 16 02 00 0b 03 00 a1 02 00 00 00 01 00 00 00 00 00 00 00 00 00 6c 01 00 00 00 00 9e

排查思路 #

• 定位CRC字段：观察重复数据包（如第4/5条、第7/8条），前48字节完全一致时最后1字节也相同，可确定CRC为数据包最后1个字节，前48字节为计算范围。
• 缩小计算范围：若全量前48字节计算不匹配，尝试拆分数据包：比如跳过自定义帧头（如开头02 2e 05 0f），只计算后续疑似Modbus的字段；或仅计算数据包中变化的字段（如第6字节、第27字节）加固定关联字段。
• 利用差异数据包反推：找仅1-2字节差异的数据包（如第2条00 8f对应CRC6e，第3条00 91对应CRC7e），通过差异值与CRC变化的关系，反推CRC的位数、poly、是否反转等参数。
• 尝试非标准CRC变体：标准Modbus为16位CRC，但老旧设备可能自定义为8位CRC，或修改了xorin/xorout、输入输出反转规则，甚至使用CRC-8/16的其他标准变体（如CRC-8/MAXIM、CRC-16/CCITT）。
• 用工具自动匹配参数：将多组（待计算数据块，CRC值）对输入逆向CRC工具，让工具遍历可能的参数组合，自动匹配符合的CRC规则。

内容的提问来源于stack exchange，提问作者user2891857